Package evidence

@block-auth.io/[email protected]

Large Javascript Payload: 4133175 bytes

Trust signals

Why this verdict

PkgRadar discounts a release’s score when public reputation argues against novel malware. The verdict above already reflects these — the panel just explains what was applied.

Weekly downloads: 181
Versions published: 17Established · −30% score
First published: Dec 2024
Publisher: wenqi.zhou

Effective trust discount applied: −30% (max across signals — discounts don’t stack). New install-lifecycle deltas vs the previous release would clear the discount.

Recommended action

Review before promoting

Mixed signals: the package has indicators worth reading before allowing the update in automated dependency flows.

Inspect tarball Add to CI gate

Block this release in CIcurl · GitHub Actions

Fail the build when this package version is added or upgraded. Replace $PKGRADAR_TOKEN with a Pro / Team API key from your dashboard.

curl -fsS https://pkgradar.com/gate/npm \
  -H "Authorization: Bearer $PKGRADAR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"specs":["@block-auth.io/[email protected]"],"fail_on":"review"}'

GitHub Actions step:

- name: PkgRadar gate
  run: |
    curl -fsS https://pkgradar.com/gate/npm \
      -H "Authorization: Bearer ${{ secrets.PKGRADAR_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"specs":["@block-auth.io/[email protected]"],"fail_on":"review"}'

Publisherwenqi.zhou

Artifact bytes8,891,806

Previous version0.8.0

Published2026-05-22T12:07:18.738Z

SHA-256781e2a087a5a38d3169cd7b27f1d49cd1540dfa0cddae53489767f83812dce51

Why flagged

What the scanner saw

Large Javascript Payload: 4133175 bytes

Not observed: package install, lifecycle script execution, or sandbox execution. PkgRadar only inspects on-disk artifacts.

Availability ledger

available

review

22d agoLast checked

reviewRisk

14Score

0.8.1Version

Status history (1 event)

new → available22d ago · risk review · score 14 · status changed

Evidence

Static findings

2 static · 0 from release diff · showing high-signal first.

Severity	Kind	Path	Detail	Points
medium	Large Javascript Payload	package/dist/main-CBmRyr4C.cjs	4133175 bytes	10
medium	Large Javascript Payload	package/dist/main-Pv60G9sq.js	5364404 bytes	10

Manifest

Package metadata

Scripts21

buildvite build
build:localENV_CONFIG=local vite build
build:typestsc
ciyarn lint && yarn format && yarn test && yarn build && yarn build:types && yarn pack
ci:compileyarn ci && yarn compile:auth
ci:withcssyarn css && yarn lint && yarn format && yarn test && yarn build && yarn build:types && yarn pack
cleannpx rm -rf dist dist-stories dist-docs .coverage package-lock.json junit.xml *.tgz node_modules yarn.lock
cleanrmrm -rf dist dist-stories dist-docs .coverage package-lock.json junit.xml *.tgz node_modules yarn.lock
compile:authcp -R blockauth-sdk-react-*.tgz ../blockauth-auth/libs/
compile:dashboardcp -R blockauth-sdk-react-*.tgz ../blockauth-dashboard/libs/
cssnpx tailwindcss -i "src/assets/css/input.css" -o "src/assets/css/output.css" -o "public/output.css"
css:devnpx tailwindcss -i "./src/assets/css/input.css" -o "./src/assets/css/output.css" -o "public/output.css" --watch
dev:localENV_CONFIG=local vite build --watch
docsstorybook dev --docs
docs:buildstorybook build --docs -o dist-docs
formatprettier --write "src/**/*.{js,jsx,}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}" --config ".prettier.json"
linteslint "src/**/*.{js,jsx}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}"
lint:fixeslint --fix "src/**/*.{js,jsx,}" ".storybook/stories/**/*.{js,jsx}" "__tests__/**/*test*.{js,jsx}"
storiesstorybook dev -p 6006
stories:buildstorybook build -o dist-stories
testNODE_OPTIONS=--jitless jest --collectCoverage --coverageDirectory=".coverage/" --ci --reporters=default --reporters=jest-junit --watchAll=false --detectOpenHandles --forceExit --runInBand

Dependencies26

@azure/msal-browser^3.10.0
@azure/msal-react^2.0.12
@block-auth.io/blockauth-lib-react^0.4.1
@coinbase/wallet-sdk4.0.3
@ethersproject/sha25.7.0
@heroicons/react^2.0.18
@radix-ui/react-slider^1.1.2
@react-oauth/google^0.12.1
@reown/appkit1.0.6
@reown/appkit-adapter-ethers51.0.6
@solana/web3.js^1.91.4
blockauth-sdk^0.1.14
buffer^6.0.3
ethers5.7.2
framer-motion^11.0.24
qrcode^1.5.3
react-icons^5.2.1
react-loader-spinner^6.1.6
react-spinners^0.13.8
rollup-plugin-node-polyfills^0.2.1
rpc-websockets7.11.0
stream-browserify^3.0.0
tailwind-children^0.5.0
tweetnacl^1.0.3
vite^5.2.0
zustand^4.3.3